Closed ghost closed 2 years ago
Ideally, in the future, we use RTTI to automatically bind a name to a specific type, as declared by the SigningScheme
. This would remove the need to declare the supportedSigningSchemes
explicitly in the licencegenerator .cpp file. RTTI can be used to get all the supported names from the enum directly. This not possible at the moment because naprtti
and mod_naplicense
are not linked into the project.
I welcome this addition and understand the need for additional (stronger) crypto schemes. I have some small suggestions, see comments, but other than that everything looks fine and I'm willing to merge. Thanks!
Thanks for the feedback. I'll make the changes and push a commit when I have a little free time this week.
@cklosters I pushed a commit to improve the PR. Let me know if I missed anything.
I'm still exploring the project and will double-click on the RTTI portion. I haven't knowingly used it in C++ before but if it draws me in enough then don't be surprised to see a future PR on this topic. Thanks!
Thanks for adding the RTTI
type information to the enum. This allows us to automatically resolve the requested scheme at runtime through type inspection, when we link in mod_naplicense
into the 'licensegenerator' tool in the future, bringing signing and verification together.
I'll take a look at your other changes asap. Thanks for taking the time to implement the changes, much appreciated.
Adds a couple overloads to validateLicense to support an optional "signing scheme" parameter. Justification is for future proofing as crypto algorithms can be broken and considered weak with research and time (e.g. SHA1 could become weak just as MD5).
This change was made with backwards compatibility in mind, avoiding any surprises to developers unless they explicitly add the new parameter to their calls to validateLicense and the "licensegenerator" tool.
Demo has been updated to show use of the signing scheme parameter and promote adoption of a stronger hashing function.